+ cc -O2 -o harness harness.c
-rwxr-xr-x  1 maxx  maxx  7800 Jul 20 20:16 harness
+ ./harness
DF-1918: mrsas_passthru unbounded sense_off (mrsas_ioctl.c:291-293)
  *sense_ptr = ioctl_sense_phys_addr writes sizeof(unsigned long)
  = 8 bytes at cmd->frame + sense_off.  sense_off is u32 from
  userspace (mrsas_ioctl.h:85), never validated.

  sense_off=0x00000080 -> 0/8 bytes past 1024-byte frame (in-bounds)
  sense_off=0x000003f8 -> 0/8 bytes past 1024-byte frame (in-bounds)
  sense_off=0x000003f9 -> 1/8 bytes past 1024-byte frame (OOB WRITE)
  sense_off=0x00000400 -> 8/8 bytes past 1024-byte frame (OOB WRITE)
  sense_off=0x00001400 -> 8/8 bytes past 1024-byte frame (OOB WRITE)
  sense_off=0xfffffff8 -> 8/8 bytes past 1024-byte frame (OOB WRITE)

  Confirmed: sense_off >= 1017 spills 1..8 bytes; sense_off
  >= 1024 spills entirely; 0xFFFFFFF8 wraps to cmd->frame - 8.
RUN_EXIT=0